CVE-2025-30211

{"id": "CVE-2025-30211", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-03-28T15:15:50.863", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-vvr3-fjhh-cfwc", "source": "[email protected]"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big KEX init packet may lead to inefficient processing of the error data. As a result, large amount of memory will be allocated for processing malicious data. Versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19 fix the issue. Some workarounds are available. One may set option `parallel_login` to `false` and/or reduce the `max_sessions` option."}, {"lang": "es", "value": "Erlang/OTP es un conjunto de librer\u00edas para el lenguaje de programaci\u00f3n Erlang. En versiones anteriores a OTP-27.3.1, 26.2.5.10 y 25.3.2.19, un mensaje de inicio de KEX malintencionado pod\u00eda generar un alto consumo de memoria. La implementaci\u00f3n no verifica los l\u00edmites especificados por RFC para los nombres de algoritmos (64 caracteres) proporcionados en el mensaje de inicio de KEX. Un paquete de inicio de KEX de gran tama\u00f1o puede provocar un procesamiento ineficiente de los datos de error. Como resultado, se asignar\u00e1 una gran cantidad de memoria para procesar datos maliciosos. Las versiones OTP-27.3.1, OTP-26.2.5.10 y OTP-25.3.2.19 solucionan este problema. Existen algunos workarounds. Se puede establecer la opci\u00f3n `parallel_login` en `false` o reducir el valor de la opci\u00f3n `max_sessions`."}], "lastModified": "2025-11-03T20:18:09.843", "sourceIdentifier": "[email protected]"}